WordPress security by component

Total Upkeep

Total Upkeep (boldgrid-backup) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Aug 12, 2026; the highest published CVSS base score is 8.2.

Plugin slug: boldgrid-backup

Latest vulnerability

CVE-2026-16253: Total Upkeep exposes its emergency restore authorization secret

Total Upkeep before 1.17.3 stores emergency-restore authorization material and restore metadata in web-served locations, including cli/verify-.php, cli/env-info.php?secret=... and cron/restore-info-.json. The CNA states that an unauthenticated attacker can recover sensitive backup information and force a full restore that overwrites live files and the database. The exact full-restore request or command sequence is not disclosed. Version 1.17.3 moves the per-install secret and restore information into protected backup storage and adds timing-safe authentication checks.

PublishedAug 12, 2026

Known safe version1.17.3

Published vulnerabilities for boldgrid-backup
		Safe version
Aug 12, 2026	CVE-2026-16253 Total Upkeep exposes its emergency restore authorization secret Total Upkeep before 1.17.3 stores emergency-restore authorization material and restore metadata in web-served locations, including cli/verify-.php, cli/env-info.php?secret=... and cron/restore-info-.json. The CNA states that an unauthenticated attacker can recover sensitive backup information and force a full restore that overwrites live files and the database. The exact full-restore request or command sequence is not disclosed. Version 1.17.3 moves the per-install secret and restore information into protected backup storage and adds timing-safe authentication checks.	1.17.3	CVE7.5 NVDPending
Aug 06, 2026	CVE-2026-66708 Total Upkeep permits unauthenticated access to protected functionality An unauthenticated visitor can reach a Total Upkeep operation that lacks the required authorization check in version 1.17.2 and earlier.	1.17.3	CVE8.2 NVDPending
May 01, 2026	CVE-2026-3143 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: A security weakness Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 1.17.1.	See mitigation notes	CVE5.3 NVDPending
Feb 27, 2025	CVE-2024-13907 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-side request forgery Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid is affected by server-side request forgery. Exploitation requires an authenticated administrator account. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE4.9 NVD6.5
Nov 26, 2024	CVE-2024-9461 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Code execution Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid is affected by code execution. Exploitation requires an authenticated administrator account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.2 NVDPending
May 17, 2024	CVE-2024-24869 Total Upkeep: Filesystem traversal Total Upkeep is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5 NVDPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers